Switching back to ensure_csrf_cookie, it does work if the javascript AJAX fix checks for the cookie at the time of the AJAX POST